While the <email>+unique@domain trick is easily avoided by spammers (strip the +unique), an alternative (and likely what the user with the 10digit random email

While the <email>+unique@domain trick is easily avoided by spammers (strip the +unique), an alternative (and likely what the user with the 10digit random email is using) is to use a personal domain name for a single user's email. The mailserver is configured to push <anything>@mydomain.com to a catch-all mailbox, and the unique TO: lines make for exceptionally flexible filtering/easy identification when a company "loses" your email address. While this is a thing, it's probably only common amongst folks who carry scars from years of adminning mailservers :)